Site hacked - redirected to some other site

[zahid4848]

Hello

I'm new to this and this never happened to me before

My site - http://www.hstas .org - seems like its been hacked and set to auto-redirect to some dummy site.

Now I have check the ftp of the site and all the files in there are intact and nothing have been deleted.
After looking it carefully there is one file which has been recently updated.
That file is .htaccess sitting in the stats folder, now I have tried deleting and replacing that file and the entire folder. Because I guess stats is a system folder it doesnt allow me to make any changes.

Please help.

Regards,
Z

[zahid4848]

Some Updates -

I was successfully able to restore all the folders and files from my back up - except the stats folder - and as I said thats where that .htaccess file is. It just keep saying I dont have permission to access that file.

I'm thinking If I would be able to restore that file, it should fix the problem - Please correct me if I'm wrong

Please help

Regards,
Z

[Slackervaara]

Are there no stats folder, when you try to restore it? If there is a stats folder and files check permissions of them with a ftp-program like FileZilla. Folders should be 755 and files 644.

[Per Yngve Berg]

Follow the procedure in the Security Checklist

[zahid4848]

Are there no stats folder, when you try to restore it? If there is a stats folder and files check permissions of them with a ftp-program like FileZilla. Folders should be 755 and files 644.

The stats folder is there with 705 permission for folder and 644 for files.

I tried to change the permission for the folder to 755 but access denied and couldnt do it.

Thanks for you help

[Slackervaara]

Have you checked ownership of the folder and files. Maybe they differ from other files and thats why you can't change permission. You have to Google to figure out how to change ownership.

[zahid4848]

Have you checked ownership of the folder and files. Maybe they differ from other files and thats why you can't change permission. You have to Google to figure out how to change ownership.

Yes I have checked the ownership of the folder, I can rename the folder but cant delete.. nor I can delete or rename the files in that folder..?

I still could not figure our where and how this site has been hacked.. guys please help..

[Slackervaara]

You could ask the webhost about help with that folder. Run the Forum Post Assistant and post the output here so we can see, if your system have any weakness.

[zahid4848]

I did ask my hosting provider, they couldnt do much either..

Please someone have any other idea to fix this?

[Slackervaara]

You could try to install the extension Admin Tools and use its feature Fix permissions.

[zahid4848]

You could try to install the extension Admin Tools and use its feature Fix permissions.

Okay I have tried that.. installed the plugin - admin tools - ran fixed permissions, even try to manually change permissions for the folder stats.. at the end still can delete that folder... ?

Please help

[Per Yngve Berg]

I guess the file is hold open by the server and therefore cannot be deleted.